{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76231", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-19T11:36:02.573Z", "datePublished": "2026-08-19T14:02:12.328Z", "dateUpdated": "2026-08-19T14:02:12.328Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-19T14:02:12.328Z"}, "datePublic": "2026-01-13T00:00:00.000Z", "title": "Renovate 32.135.0 before 40.33.0 Command Injection via hermit", "descriptions": [{"lang": "en", "value": "Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "cweId": "CWE-77", "type": "CWE"}]}], "affected": [{"vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "versions": [{"version": "32.135.0", "status": "affected", "versionType": "semver", "lessThan": "40.33.0"}, {"version": "40.33.0", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-36j9-mx87-2cff)"}, {"url": "https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: Renovate 32.135.0 before 40.33.0 Command Injection via hermit", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit"}], "credits": [{"lang": "en", "value": "astellingwerf", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "product": "renovate", "vendor": "renovatebot", "versions": [{"lessThan": "40.33.0", "status": "affected", "version": "32.135.0", "versionType": "semver"}, {"status": "unaffected", "version": "40.33.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate."}], "id": "CVE-2026-76231", "lastModified": "2026-08-19T14:17:50.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-08-19T14:17:50.453", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "renovate: Renovate: Arbitrary command execution via unsanitized dependency names", "id": "2519628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519628"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows an attacker to execute arbitrary commands on the machine running Renovate."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-76231", "public_date": "2026-08-19T14:02:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76231\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76231\nhttps://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c\nhttps://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c\nhttps://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e\nhttps://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df\nhttps://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff\nhttps://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit"], "statement": "This flaw has a MODERATE impact on Renovate. A command injection flaw in Renovate's hermit manager allowed a user with repository write access to execute arbitrary commands on the machine running Renovate by supplying a maliciously named dependency, which was appended to install/uninstall commands without sanitization. The version of Renovate shipped by Red Hat is beyond the upstream fix (40.33.0); the vulnerable hermit-manager code is not present in the shipped version, so Red Hat's product is not affected.", "threat_severity": "Moderate"}

{"created": "2026-08-19T19:00:05.217633+00:00", "updated": "2026-08-19T19:00:05.217638+00:00", "vendors": []}